What’s Vulnerable › Vulnerabilities
CVE-2026-33879: FLIP doesn't have rate limiting or brute-force protection on login
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-03-27 · updated 2026-10-26
- Weakness: CWE-307
Description
Federated Learning and Interoperability Platform (FLIP) is an open-source platform for federated training and evaluation of medical imaging AI models across healthcare institutions. The FLIP login page in versions 0.1.1 and prior has no rate limiting or CAPTCHA, enabling brute-force and credential-stuffing attacks. FLIP users are external to the organization, increasing credential reuse risk. As of time of publication, it is unclear if a patch is available.
Affected products
- Aicentre Federated Learning And Interoperability Platform: before 0.1.1 — fixed in 0.1.1
How to fix
Upgrade to a fixed version: Aicentre Federated Learning And Interoperability Platform 0.1.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-33879 or the next vulnerability affects your stack